Cyber Posture

CVE-2026-20125

High

Published: 25 March 2026

Published
25 March 2026
Modified
26 March 2026
KEV Added
Patch
CVSS Score 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0018 38.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20125 is a high-severity Improper Handling of Syntactically Invalid Structure (CWE-228) vulnerability in Cisco IOS Software (inferred from references). Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Remediating the input validation flaw in the Cisco IOS HTTP server via timely patching prevents exploitation by malformed requests causing device reloads.

prevent

Requiring validation of user-supplied HTTP inputs directly mitigates the improper validation vulnerability that allows malformed requests to trigger DoS.

prevent

Implementing denial-of-service protections limits the impact of malformed HTTP requests that could exhaust resources or cause watchdog timer expiration and reloads.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Vuln directly enables remote exploitation of public-facing HTTP server (T1190) via malformed input to trigger system reload/crash (T1499.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.…

more

This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malformed HTTP requests to an affected device. A successful exploit could allow the attacker to cause a watchdog timer to expire and the device to reload, resulting in a DoS condition. To exploit this vulnerability, the attacker must have a valid user account.

Deeper analysisAI

CVE-2026-20125 is a vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E. The issue arises from improper validation of user-supplied input, which could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. Published on 2026-03-25, the vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) and maps to CWE-228.

An attacker can exploit this vulnerability by sending malformed HTTP requests to an affected device, provided they possess a valid user account. Successful exploitation triggers a watchdog timer expiration, forcing the device to reload and disrupting network services in a DoS scenario. The low complexity and privileges required (local authenticated access) combined with network accessibility make it feasible for targeted attacks.

Details on mitigation, workarounds, and patches are available in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-dos-sbv8XRpL.

Details

CWE(s)

Affected Products

Cisco
IOS Software
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2024-55594Shared CWE-228
CVE-2025-0343Shared CWE-228
CVE-2026-34232Shared CWE-228
CVE-2023-42784Shared CWE-228

References